March 2001 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 - first ALPHA
by marc＠suse.de 06 Mar '01

06 Mar '01

For the desperate: SuSEfirewall2 v0.3 is available for testing from www.suse.de/~marc It installs without problem with a SuSEfirewall(1) installation, the only variable shared is the START_FW variable (well, with the result that both firewall will try to start when booting ;-) please note: due my current network probs at home I could not make real tests. so everyone who can check features, and if possible send me a fix for something which is not working - that would be great!! Q: What changed from SuSEfirewall(1) to SuSEfirewall2 A: Many things. Most important: it uses iptables (which is especially for 2.4 kernels) instead of ipchains. Visible changes: New commandline option "debug" which prints out the iptables commands, great to print the rules, and them modify them for you liking! Added the new options: FW_ALLOW_CLASS_ROUTING - allow routing between interfaces of the same class, e.g. two internal networks FW_ALLOW_FW_BROADCAST - allow broadcast packets to reach the firewall FW_ALLOW_PING_EXT - allow the internal/dmz to ping the internet FW_SERVICE_AUTODETECT - autodetect START_{NAMED,SMB,DHCPD} and DHCLIENT Renamed some variables, removed some, changed syntax (small changes) All forward,masquerading,trust definitions can now be very global or very fine-grained as you need it The logging looks different - hell this is iptables :-( It takes a bit longer to create the complex ruleset :-( Invisible changes: A packet has to traverse much less rules, so packet processing is faster Stateful packet checking is present now (thanks to the 2.4 kernel) More intelligent ICMP filtering and identd rejection Greets, Marc -- Marc Heuse, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: marc(a)suse.de Function: Security Research and Advisory PGP: "lynx -source http://www.suse.de/~marc/marc.pgp | pgp -fka" Key fingerprint = B5 07 B6 4E 9C EF 27 EE 16 D9 70 D4 87 B5 63 6C Private: http://www.suse.de/~marc SuSE: http://www.suse.de/security

3 9

Re: AW: [suse-security] bind8 update Problem
by Hans Vokal 06 Mar '01

06 Mar '01

--- Alexander Bien <abien(a)gmx.net> schrieb: > > Wenn du an antworten interessiert ist .. solltest du beachten das die suse > list auf englisch läuft .. Oops! so sorry. But thankss for the help anyway bind8 runs now smoothly. cu Hans __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

IMAP Server II and security updates
by Martin Sckopke 06 Mar '01

06 Mar '01

Hi all, I've got a question regarding the SuSE-IMAP-Server II. Do all security related updates apply to this version of SUSE, too? Did anyone upgrade SuSE-EMail Server to SuSE 7.1? Did anyone upgrade to Kernel > 2.4 (i.e. 2.4.2.SuSE-5 ?) Thanks a lot for your help, Martin -- GiS - Gesellschaft fuer integrierte Systemplanung mbH Martin Sckopke Tel. +49-6201-503-74 Junkersstr. 2 Fax +49-6201-503-66 D-69469 Weinheim m.sckopke(a)gis-systemhaus.de

5 7

RE: [suse-security] IMAP Server II and security updates
by rfertig＠telebel.net 06 Mar '01

06 Mar '01

Hi Björn. > I upgraded my ("ordinary", not IMAP-Server) SuSE 7.1 to 2.4.2.SuSE-5. > But after installing the new Kernel (compiled with the same settings > as the pre-built 2.4.0), some modules didn't load anymore - just a > silly message is being shown : > "Kernel version mismatch - module was built for kernel 2.4.2-4GB while > this is kernel 2.4.2." > > At home I had a similar problem, but the other way around: > "... module was built for kernel 2.4.2 while this is kernel 2.4.2-4GB" I've got the same message when I try to insmod a patched networkdriver (modul is 2.4.0, kernel 2.4.0-4GB). The only way I found to get things work (except insmod -f) was to modify the Makefile and comment out all ifdef-lines (and related) in the section "Test for Highmen support" and only leave the line HIGHMEMVERSION="-4GB" It seems to me, that there is an error in the Makefile or in .config but since I'm not verry familar with these things I didn't found it. However, this all isn't security-related, but someome at SuSE should take a look at this (I already send a mail to the support). Bye, Rene

1 0

ssh, warnings
by Joerg Henner 06 Mar '01

06 Mar '01

Hi, i'm having these messages occur with fw:~ # rpm -qa|grep -i ssh openssh-2.3.0p1-0 ---[cute here]--- Mar 5 15:16:26 fw sshd[1343]: WARNING: /etc/ssh/primes does not exist, using old prime ---[cute here]--- System is an SuSE 6.4 Any Hints ? Greetings, -- Jörg Henner Fon: +49 (7 11) 2 85 19 05 LiHAS - Servicebuero Stuttgart Fax: +49 (7 11) 5 78 06 92 Adrian Reyer & Jörg Henner GbR Mail: lihas(a)lihas.de Linux, Netzwerke, Consulting & Support http://lihas.de/

1 0

Suggstion on security
by John Murphy 05 Mar '01

05 Mar '01

I have a cable Internet connection and run it through a Linksys router. This has NAT built in for protection. Of course through this I run DHCP to three other machines in a home network, 1 linux and 2 wins. Is this good enough or do I need to setup a personal firewall besides. I have Suse 7.1 and don't have the personal firewall on as this is the way the auto setup did it through Yast. If I do turn it on will this throw a monkey wrench into the something that is running fine now. I'm a newbie at firewalls and the option of just having it done automatically seemed appealing. But I figured Yast has to be much brighter then me and it had to be a reason. I'm thinking because of the DHCP? John......... -- Contentment is not the fulfillment of what you want, but the realization of how much you already have.

2 1

Re: [suse-security] Secure Syslogd
by christian.burri＠synecta.ch 05 Mar '01

05 Mar '01

Gerd Bitzer <gerd.bitzer@ To: RoMaN SoFt/ LLFB!! <roman(a)madrid.com> tesion.de> cc: suse-security(a)suse.com Subject: Re: [suse-security] Secure Syslogd 02.03.01 08:28 Good morning Roman, "RoMaN SoFt / LLFB!!" wrote: > On Thu, 01 Mar 2001 13:09:13 +0100, you wrote: > > >Hi List, > > > >does anybody know a secure dropin Replacement for the standard syslogd, > >which supports libwrap-style ACL's ? > > Ummm there are several ones (try at securityportal.com: there's at > least an article about that), I don't know if they support libwrapp. > I'd recommend using the standard syslogd with some acl's in your > router since other replacements aren't standard and you won't be able > to, for instance, receive logs from other boxes (routers, switches, > load-balancers, etc). >Hmm, I know the page on securityportal.com, the daemons there are quite >interesting as they implement such things as syslog over tcp or even over >ssl. But thats a little bit oversized for my needs. > > > Standard syslog goes over UDP and not encrypted. It's easy to defeat > if you don't set the aproppiate fw rules (router acl's, eg). I had a > look at some alternatives some time ago but none of them convince me. > Many of them were not mature enough and I decided to leave the > original syslogd. >There's an alternate rpcbind daemon from Vietse Venema which implements such >libwrap based ACL's for RPC, which makes sense in my opinion, but I haven't >found an adequate, simple dropin syslogd :-( what would be a "secure" replacement? why is syslog not secure? answer: because it relies on UDP. Now, you should simply use something that does not rely on UDP to transport log messages. But then, it isnt a drop-in replacement, is it? Thats kinda fsck'd .. What I would do is, block UDP traffic in general (with a few exceptions) at the border router or firewall, so I dont have people sending UDP traffic into my network. If I'd need to carry UDP traffic thru an untrusted network, then I'd rely on VPN technology. But, *at least* I'd block UDP traffic on syslog port at the border routers... And then, I'd ignorantly continue to use standard syslogd :-) Cheers chris >Maybe anybody in this list does have knowledge about such a beast ;-) > > > =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= > ** RoMaN SoFt / LLFB ** > roman(a)madrid.com > http://pagina.de/romansoft > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > --------------------------------------------------------------------- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com --------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

bind8 update Problem
by Hans Vokal 05 Mar '01

05 Mar '01

Hallo Nachdem wohl inzwischen alle ihren named upgedated haben komme ich hinterher wie die alte fasnacht... Mein Problem ist, das nach dem update von bind4 auf bind8 nur intern bekannte Rechnernamen aufgelöst werden. Externe Rechnernamen (z.B. www.suse.de) werden nicht aufgelöst. Der Rechner ist übrigens mit SuSE 6.0 bestückt. Die selbe Konfiguration läuft auf einem anderen REchner (auch SuSE 6.0) Problemlos. Der Rechner, der die Probleme macht, hat ein paar Firewall-regeln am laufen, da aber bei bind4 alles klappt, weiß ich nicht ob das relevant ist. Verhält sich der bind8 bei forward-Anfragen anders als bind4 ? Wahrscheinlich bin ich nur blind (aber um jeden Hinweis dankbar) Hans . __________________________________________________________________ Do You Yahoo!? Gesendet von Yahoo! Mail - http://mail.yahoo.de

1 0

Re: [suse-security] SMTP antiSpam proxy ???
by andreas.baetz＠herma.de 05 Mar '01

05 Mar '01

Andreas Siegert wrote: >Quoting Nix (suse(a)nix.hispeed.com) on Mon, Mar 05, 2001 at 02:54:24AM +0100: >> This is exactly what Obtuse SMTPD was designed to do. It is on the SuSE cd's >> Check out www.obtuse.com for more info. >I stopped using it. It does not handle Mailer Daemon Bounces with <> Addresses >propperly. If that means it doesn't accept bounces and denies them, you could use something like this in your smtpd-check-rules: # handle mail from: <> # outgoing messages allow:(your internal net):/^$/:ALL # incoming messages allow:ALL:/^$/:ALL@(your mail domain) This works for me. Andreas Baetz ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been scanned for the presence of computer viruses. **********************************************************************

1 0

SuSE Security Announcement: cups
by Sebastian Krahmer 05 Mar '01

05 Mar '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: cups Announcement-ID: SuSE-SA:2001:05 Date: Monday, March 5th, 2001 13:10:13 MET Affected SuSE versions: 7.1 Vulnerability Type: local/remote root compromise Severity (1-10): 5 SuSE default package: no Other affected systems: All UN*X-systems using cups < 1.1.6. Content of this advisory: 1) security vulnerability resolved: cups problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information CUPS is an implementation of the Internet Printing Protocol (IPP) and is used as an alternative to the lpr and LPRng packages. The CUPS package aims to be a comprehensive printing solution for UN*X-systems. In SuSE-7.1 distribution, the cups package is not used by any configuration utilities unless the admin has decided to configure the package manually. The cups package has been introduced in the SuSE-7.1 distribution; enhanced support for future releases of the SuSE Linux distribution is planned. A SuSE-internal security audit conducted by Sebastian Krahmer and Thomas Biege revealed several overflows as well as insecure file handling. These bugs have been fixed by adding length-checks and securing the file-access. For a temporary workaround, remove the suid-bit from the 'lppasswd' program. Make sure nobody from outside your network can access the CUPS-server running on port 631. Allowing access to this port from outside is a bad idea regardless whether or not the used version is vulnerable. No remote-exploits are known yet. Download the update package from locations desribed below and install the package with the command `rpm -Uhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/d3/cups-devel-1.1.6-13.i386.rpm 23c6484952ab0c1de81e2db38bcd3afc SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/cups-1.1.6-13.i386.rpm 812e0c47dcfe508eb9e8ccb38165b6d7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cups-1.1.6-13.src.rpm 204cea2ad6a61293c191e70a2cacdc82 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: Effective Monday, March 19 2001, five weeks after the release of the new SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2. SuSE puts much effort into adding security improvements (patches) to the software instead of publishing a new version; the same program with a fix for a specific problem promises to work just as reliable as the original version from the distribution, whereas new versions introduce new functionality which changes the behaviour. In some cases however, especially if the security leak is based on problematic design decisions or when the fix(es) are fairly large, the only reasonable fix for a security problem is to update to a newer version of the software. These newer versions tend to become incompatible with our older distribution releases because of missing features in the operating system environment. This forces us to focus on the distributions of a newer release date. The remaining distributions SuSE-6.3, SuSE-6.4, SuSE-7.0 and SuSE-7.1 for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms will continue to be supported for a two-year period after the release of the respective distribution. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =============================================== SuSE's security contact is <security(a)suse.com>. =============================================== Regards, Sebastian Krahmer ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOqODeXey5gA9JdPZAQHRYQf/aNhY+lHrkpmWlxGtQI29qetDlIuqVbvQ jUb4jm6vMvYJrFwzhtZ9XpWWYECDiqQjhy9KwmkkaVBrDTtbboNuQ+Wqq93zLzTD t1uXxGqb3p847p3OtoxZXR9ZUxxB+tn6MS2CGUZVDA+TaYgUD9DW1eb9+z0t5ehN 2cdYZqvAp22BasIdXGlFSvCJ4oBqXT9HmqBk8Q+FS7ZzT0VKvOmXShqv5bWOPRj+ XwuuiPdPGc9Ykwp8lcoymU2Y8b62MASEVYsFT4rynMxrDSfNUaEPXTAhc2RPM9vn +BgXrT0rfUiPkRWQTNpokp93TO3v8cOFgw0keeLcYRbP1nk36Ng03w== =BWbh -----END PGP SIGNATURE-----

1 0